In brief
NIS2 applies to manufacturing companies that fall into the manufacturing sub-sectors of Annex II (for example computers and electronics, electrical equipment, machinery and motor vehicles) or into the food sector, and that are at least medium-sized enterprises (Article 2(1)). In manufacturing, the OT environment, suppliers and the impact of downtime are also key.
Does NIS2 also apply to manufacturing companies?
Yes, to some of them. Annex II of NIS2 also covers the manufacturing sector, but not all manufacturing activities automatically. First check whether the company falls into one of the covered manufacturing sub-sectors, and then whether it meets the size criteria in Article 2(1).
For manufacturing companies it is particularly important that the assessment does not stop at documentation. In practice, critical assets, production downtime, the link between OT and IT, suppliers and the ability to demonstrate the actual state are also key.
The most common mistake: the company determines whether it is in scope based only on its general activity, not on its specific sub-sector, size and impact on operations.
How a manufacturing company checks whether it is in scope
Manufacturing companies need to check two levels: first whether they fall into a covered sub-sector, and then whether they reach the size criteria. GOV.SI portal
Check the sub-sector
Being “manufacturing” is not enough. What matters is whether you are one of the covered types of entities in the manufacturing part of Annex II. GOV.SI portal
Check the size
Check whether the company is at least a medium-sized enterprise under the EU definition (in Slovenia: at least 50 employees and at least EUR 10 million turnover or balance sheet total). In its guidance on the food sector, URSIV explicitly stresses that these entities are presumed to be in scope only if they meet the size criteria. GOV.SI portal
Check the actual scope
With several activities, what matters is which activity is actually relevant for the assessment, not only how the company describes itself.
Which manufacturing sub-sectors are particularly relevant
In its answers to questions, URSIV explicitly states that Annex II in the manufacturing sector covers sub-sectors related to computers, electronics, electrical equipment and machinery, linked to NACE Rev. 2 divisions. GOV.SI portal
Sub-sectors explicitly mentioned by URSIV
- manufacture of computer, electronic and optical products,
- manufacture of electrical equipment,
- manufacture of other machinery and equipment. GOV.SI portal
Manufacturing more broadly under Annex II
- medical devices,
- computers, electronics and optics,
- electrical equipment,
- machinery and equipment,
- motor vehicles,
- other transport equipment. GOV.SI portal
Note: this does not mean that every manufacturing company is in scope. First check the classification in the specific sub-sector and then the size criteria. GOV.SI portal
Why NIS2 is different for manufacturing than for “office” companies
In manufacturing, an incident often has not only IT consequences but also operational, logistical and financial ones.
OT and IT are intertwined
In manufacturing, business systems, industrial devices, PLC environments, production lines and external connections are often linked.
Downtime is not just an “incident”
A disruption can mean an actual production outage, delivery delays, contractual consequences and pressure from customers.
Suppliers are critical
In manufacturing, a large part of the risk often lies in the supply chain, service technicians, integrators and external maintenance providers.
Asset inventory is harder
In practice it is often harder to inventory critical assets, because they are not just servers and workstations but also industrial components.
Changes have operational consequences
Security cannot be introduced without considering the impact on production, maintenance and availability.
Supervision requires demonstrability
What matters is not only that measures are written down, but that you can show how they relate to actual processes and assets.
What supervision will look at first in a manufacturing company
In manufacturing, expect questions that quickly touch the actual state of production, critical assets and suppliers.
Typical questions
- which assets are critical for production,
- which processes are key and what the consequences of an outage are,
- who has access to critical systems,
- how suppliers and external contractors are handled,
- how changes and incidents are managed.
What companies often have not sufficiently in order
- an inventory of OT/IT assets,
- a clear risk register,
- a BIA and the impact of production downtime,
- a record of management decisions,
- evidence of implemented measures and the status of open tasks.
What we see in practice: a manufacturing company often thinks its “security” is in order because it has antivirus, backups and a few rules. Supervision, however, is interested in whether the system is managed, responsibilities defined and evidence traceable.
A special case: food, beverages and processing
In its explanations, URSIV specifically explains that the sector “production, processing and distribution of food” includes companies carrying out food business activities, including industrial production and processing; the explanation also explicitly mentions that beverages count as food. At the same time it stresses that these entities are in scope only if they also meet the size criteria. GOV.SI portal
What this means in practice
- a company in food or beverage production can be in scope,
- but producing food or beverages is not enough on its own,
- the size threshold and the actual type of activity must also be checked. GOV.SI portal
First steps for a manufacturing company
Even if you are not yet sure whether you are in scope, it makes sense to start with a structured review.
Check NACE codes and activities
The formal classification is a good start, but not always enough. The company's actual activity also matters. GOV.SI portal
Check the size
The number of employees and the turnover or balance sheet total are the key filter for most entities. GOV.SI portal
Inventory critical assets
Without a clear overview of critical assets it is hard to build a useful risk register and demonstrate readiness.
Assess the impact of downtime
In manufacturing it is key to understand what the outage of a machine, a line, an MES/ERP system or a connection to suppliers means.
Put evidence in order
If you cannot quickly show measures, responsible persons and decisions, that is a bad sign during supervision.
Carry out a scope assessment
The fastest route is a short review of status, sub-sector, size, critical processes and the biggest gaps.
How Regulus Ai helps manufacturing companies
In manufacturing, the combination of regulatory understanding, operational reality and demonstrability for supervision is key. More on our services: NIS2 compliance, business continuity to ISO 22301 and – for manufacturers of products with digital elements – the Cyber Resilience Act (CRA).
1. Scope assessment for manufacturing
We check whether the company falls into a relevant manufacturing sub-sector, whether it reaches the size threshold and which obligations really apply.
2. Inventory of critical assets and risks
We help link business processes, critical assets, suppliers and actual operational risks.
3. Documentation and evidence
We build not just documents, but also a trail of evidence, status of measures, decisions and responsibilities.
4. Preparation for supervision
The goal is that, when asked to “show us”, the company does not improvise but can show the actual state.
In manufacturing, it is not only whether you are in scope that matters — it is whether you can demonstrate readiness.
Book an initial consultationFrequently asked questions about NIS2 for manufacturers
Does NIS2 apply to every manufacturing company?
No. First check whether the company falls into a covered manufacturing sub-sector, and then whether it meets the size criteria. GOV.SI portal
Do OT systems matter in manufacturing?
Yes. In manufacturing, the link between OT and IT is often one of the key specifics, because an incident can directly affect production, availability and delivery.
Are food and beverages also among the relevant sectors?
Yes. URSIV specifically explains the sector of production, processing and distribution of food and stresses that beverages count as food; the size threshold still has to be checked. GOV.SI portal
What is hardest to put in order in a manufacturing company?
Most often the inventory of critical assets, the link between OT and IT, the risk register, the status of measures, the record of decisions and the ability to demonstrate the actual state.
Does Regulus Ai also help determine scope?
Yes. We help with scope and status assessment, an inventory of key risks, preparing evidence and preparing the company for supervision.
Sources
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
- URSIV – answers to frequently asked questions (in Slovenian)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
Published: · Last updated: · Prepared by the Regulus Ai team
Don't guess whether your manufacturing operation is in scope of NIS2
Regulus Ai helps you check the company's status, sub-sector, size threshold, key risks and the most important steps towards compliance.